Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning

Pavel Machek
2008-08-14T14:00:28Z

On Wed 2008-08-13 15:16:12, tvrtko.ursulin@sophos.com wrote:
> Arjan van de Ven <arjan@infradead.org> wrote on 13/08/2008 14:54:01:
>
> > > I am not sure what you are suggesting, and I may have missed the
> > > libmalware proposal (I don't see any mention of that specific idea in
> > > any other message). However, just to be clear... At no point did we
> > > suggest that the kernel would do any scanning. What we have been
> > > interested in is a mechanism that can allow a scanning application to
> > > be notified by the kernel of specific i/o events, for those events to
> > > be blocked by the kernel until a user-space scan is done, and then the
> > > user-space scan sends back allow or deny, at which point the i/o event
> > > returns to the caller -- either success or error. This is the only
> > > way that malware can be guaranteed of being detected when it is used
> > > (for local application purposes or for transmission to another
> > > platform) or created.
> >
> > this is a very broad statement that ignores the LD_PRELOAD approach,
> > and thus not true.
>
> LD_PRELOAD does not solve at least knfsd and suid binaries. But we are
> going in circles. :)

Yes, there are about 5 suid binaries on typical linux system. Link
them to libmalware by hand.

> > > Also, a solution that requires applications to be modified will not
> > > work, because there is no way that we would be able to get ALL
> > > applications on the machines to be modified in the required ways. If
> > > ANY applications are not so modified, then you have an unacceptable
> >
> > you don't need to modify applications to make them use a library...
>
> Same is true for a kernel solution. Plus, it also works for those who make
> system calls directly, knfsd and suid binaries, and we can have cheap and
> ultra-efficient caching. Not much kernel code, even less complex kernel
> code and unmeasurable impact when not used and compiled in. What are the
> big technical objections to that?

That is does not work?

(Neither does LD_PRELOAD; it still has the old mmap problem. Too bad,
but at least you get 99.9% coverage of all the apps).
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html